The FBI now tracks AI-enabled fraud as its own category. In 2025, its first full year doing so, US complaints referencing AI totaled 22,364 reports and $893.35 million in adjusted losses — and that's just what got reported, categorized correctly, and confirmed.

Confirmed

According to a Gartner survey of 302 security leaders published in September 2025, 62% of organizations reported experiencing a deepfake-enabled attack in the prior twelve months. Entrust separately found that roughly one in five biometric identity-fraud attempts now involves a deepfake element. On the human side, the numbers are worse than most people assume: a 2024 peer-reviewed meta-analysis of 56 studies found average human deepfake-detection accuracy sits at 55.54% — barely above a coin flip — and in a 2,000-person iProov study, only 0.1% of participants correctly identified every fake and real sample they were shown, while 60% reported feeling confident in their judgment anyway. For high-quality video specifically, human detection rates fall to roughly 24.5%.

Regulation is catching up in real time. The EU AI Act's Article 50 labeling obligations, which require disclosure when content is AI-generated or manipulated, become binding on August 2, 2026. In the US, the TAKE IT DOWN Act's 48-hour takedown requirement for non-consensual synthetic imagery has been in force since May 19, 2026, and 47 of 50 states now have some form of deepfake-specific law on the books.

Genuinely uncertain

Here's the part that matters most and gets skipped most often: a large share of the deepfake statistics circulating publicly don't hold up to scrutiny. One detailed 2026 analysis flags that vendor-reported "surge" percentages — 2,100%, 3,892%, 1,300%, and similar figures that circulate widely — frequently share no common baseline or methodology, sometimes contradict each other outright, and in at least one case a vendor's own quarterly incident count exceeded its full-year total from the same report. There is, as that analysis puts it plainly, "no defensible global deepfake-loss total," because complaint databases, blockchain analysis, vendor telemetry, and detection benchmarks all count fundamentally different things. This doesn't mean the problem is smaller than it looks — the FBI and Gartner figures above are independently sourced and methodologically transparent — but it does mean a healthy dose of skepticism belongs on almost every eye-popping deepfake number that isn't tied to a named source and a measurement window.

Detection technology's real-world reliability is also weaker than marketing suggests. Most commercial detector benchmarks test against datasets that overlap with their own training data, producing accuracy figures that don't hold up once the tool meets fraud attempts built after the detector was trained — an arms race where the defender is always working from slightly stale data.

Worth examining honestly

CIPHER-7 would tell you the real crisis isn't any single fraud number — it's that human beings, on average, cannot reliably tell real from fake anymore, and most people don't know that about themselves. GHOST PROTOCOL would add that 80% of people surveyed say they'd trust a company more if it visibly offered deepfake protection — meaning the fix, right now, is mostly a market opportunity for whoever builds trustworthy verification first, not a solved technical problem.

The Door This Opens

This door isn't about whether deepfakes are a real threat — the FBI's own tracked losses settle that. It's about what happens to a society when the average person's ability to verify what they're seeing drops to coin-flip odds, faster than regulation, detection tools, or public awareness can catch up. The verification crisis isn't coming. The numbers above say it's already here, just unevenly distributed and often mis-measured.